About SSL Encryption

What is Encryption?

According to Wikipedia, encryption is the process of encoding a message or information in such a way that only authorized parties can access it. Encryption does not itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as plain text, is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. It is in principle possible to decrypt the message without possessing the key, but, for a well-designed encryption scheme, considerable computational resources and skills are required. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients but not to unauthorized users.

What is SSL?

SSL, or more specifically, SSL certificate is a digital document issued for an organization or business (or pretty much anyone who owns a domain) to prove ownership of an specific domain. This documents are issued by entities referred to as "Internet Authorities", and in the case of web use, it is up to the browser being used to decide whether to trust or not the issuer of the certificate. If the certificate is verified and trusted by the web browser, the site will load, and depending on the browser, an indication for secure browsing should appear (it usually presents as a green lock followed the protocol name "https://") as shown in the picture. If the certificate is not valid, or the browser doesn't trust the issuer, a privacy error message will appear, alerting the user that the site could be a replica or a scam.

It's not bullet proof

Just like pretty much everything, SSL Encryption is not perfect. And therefore it is not completely secure. There is multiple ways in which information could be compromised. Some examples include:

• Phishing: This technique is mostly used in e-mailing, but is also widely used to steal information from unsuspecting users browsing the web. This method consists of making a replica of a legitimate website, and locating it in a very similar domain mane, where users will land occasionally when a site's URL is misspelled. Information is then gathered when the user tries to sign in or inputs sensible information onto the fraudulent website. Scam-website owners can also request an SSL certificate for their domain, making the browser trust the site. To protect your self agains this, there is a couple things that can be done:
  • Verify that the site is running HTTPS and has a valid SSL certificate.
  • Before entering any data, check the site's address for any spelling errors.

• Packet Intersection / Analyzing: Data is just electricity traveling through cables (or light in the case of fiber), or electromagnetic pulses spreading in space. Therefore, anyone who has access to the cable, or even worse, anyone within range of a Wi-Fi network can see what is going on in the air at that time. Using encrypted connections can alleviate some of these concerns, and although encrypted data can still be stolen, decrypting it is a task that requires a lot of ability, time and computing power (depending on the encryption method used in the first place). For this:
  • When possible, avoid using open Wi-Fi networks.
  • When on an open Wi-FI network, use secure protocols to encrypt you data. Even if the Wi-Fi network is unencrypted using encrypted protocols encrypts data before sending it off.
  • Utilize services like VPN's, which encrypt all traffic going to and from you computer, just make sure you can trust the service provider.